# CVEs published 2018-10-02

78 CVEs were published on October 2, 2018: 0 critical, 8 high. Days are UTC.

- [CVE-2017-7908](https://cve.now/CVE-2017-7908.md): A heap-based buffer overflow exists in the third-party product Gigasoft, v5 and prior, included in GE Communicator 3.15 and prior. (no CVSS, GE Communicator)
- [CVE-2018-14822](https://cve.now/CVE-2018-14822.md): Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, wh (no CVSS, Entes EMG12)
- [CVE-2018-14826](https://cve.now/CVE-2018-14826.md): Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with (no CVSS, Entes EMG12)
- [CVE-2018-3943](https://cve.now/CVE-2018-3943.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. (CVSS 8.0, Foxit PDF Reader)
- [CVE-2018-3944](https://cve.now/CVE-2018-3944.md): An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. (CVSS 8.0, Foxit PDF Reader)
- [CVE-2018-3957](https://cve.now/CVE-2018-3957.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit PDF Reader)
- [CVE-2018-3958](https://cve.now/CVE-2018-3958.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit PDF Reader)
- [CVE-2018-3959](https://cve.now/CVE-2018-3959.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit PDF Reader)
- [CVE-2018-3960](https://cve.now/CVE-2018-3960.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit PDF Reader)
- [CVE-2018-3961](https://cve.now/CVE-2018-3961.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit PDF Reader)
- [CVE-2018-3962](https://cve.now/CVE-2018-3962.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.0.5096. (CVSS 8.0, Foxit PDF Reader)
- [CVE-2018-11748](https://cve.now/CVE-2018-11748.md): Previous releases of the Puppet device\_manager module creates configuration files containing credentials that are world readable. (no CVSS)
- [CVE-2018-11750](https://cve.now/CVE-2018-11750.md): Previous releases of the Puppet cisco\_ios module did not validate a host's identity before starting a SSH connection. (no CVSS)
- [CVE-2018-11752](https://cve.now/CVE-2018-11752.md): Previous releases of the Puppet cisco\_ios module output SSH session debug information including login credentials to a world readable file o (no CVSS)
- [CVE-2018-9452](https://cve.now/CVE-2018-9452.md): In getOffsetForHorizontal of Layout.java, there is a possible application hang due to a slow width calculation. (no CVSS, Google Android)
- [CVE-2018-9473](https://cve.now/CVE-2018-9473.md): In ihevcd\_parse\_sei\_payload of ihevcd\_parse\_headers.c, there is a possible out-of-bounds write due to an integer overflow. (no CVSS, Google Android)
- [CVE-2018-9476](https://cve.now/CVE-2018-9476.md): In avrc\_pars\_browsing\_cmd of avrc\_pars\_tg.cc, there is a possible use-after-free due to improper locking. (no CVSS, Google Android)
- [CVE-2018-9490](https://cve.now/CVE-2018-9490.md): In CollectValuesOrEntriesImpl of elements.cc, there is possible remote code execution due to type confusion. (no CVSS, Google Android)
- [CVE-2018-9491](https://cve.now/CVE-2018-9491.md): In AMediaCodecCryptoInfo\_new of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an integer overflow. (no CVSS, Google Android)
- [CVE-2018-9492](https://cve.now/CVE-2018-9492.md): In checkGrantUriPermissionLocked of ActivityManagerService.java, there is a possible permissions bypass. (no CVSS, Google Android)
- [CVE-2018-9493](https://cve.now/CVE-2018-9493.md): In the content provider of the download manager, there is a possible SQL injection due to improper input validation. (no CVSS, Google Android)
- [CVE-2018-9496](https://cve.now/CVE-2018-9496.md): In ixheaacd\_real\_synth\_fft\_p3 of ixheaacd\_esbr\_fft.c there is a possible out of bounds write due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9497](https://cve.now/CVE-2018-9497.md): In impeg2\_fmt\_conv\_yuv420p\_to\_yuv420sp\_uv\_av8 of impeg2\_format\_conv.s there is a possible out of bounds write due to missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9498](https://cve.now/CVE-2018-9498.md): In SkSampler::Fill of SkSampler.cpp, there is a possible out of bounds write due to an integer overflow. (no CVSS, Google Android)
- [CVE-2018-9499](https://cve.now/CVE-2018-9499.md): In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. (no CVSS, Google Android)
- [CVE-2018-9501](https://cve.now/CVE-2018-9501.md): In the SetupWizard, there is a possible Factory Reset Protection bypass due to a permissions bypass. (no CVSS, Google Android)
- [CVE-2018-9502](https://cve.now/CVE-2018-9502.md): In rfc\_process\_mx\_message of rfc\_ts\_frames.cc, there is a possible out-of-bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9503](https://cve.now/CVE-2018-9503.md): In rfc\_process\_mx\_message of rfc\_ts\_frames.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9504](https://cve.now/CVE-2018-9504.md): In sdp\_copy\_raw\_data of sdp\_discovery.cc, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Google Android)
- [CVE-2018-9505](https://cve.now/CVE-2018-9505.md): In mca\_ccb\_hdl\_req of mca\_cact.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9506](https://cve.now/CVE-2018-9506.md): In avrc\_msg\_cback of avrc\_api.cc, there is a possible out-of-bound read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9507](https://cve.now/CVE-2018-9507.md): In bta\_av\_proc\_meta\_cmd of bta\_av\_act.cc, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Google Android)
- [CVE-2018-9508](https://cve.now/CVE-2018-9508.md): In smp\_process\_keypress\_notification of smp\_act.cc, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Google Android)
- [CVE-2018-9509](https://cve.now/CVE-2018-9509.md): In smp\_proc\_master\_id of smp\_act.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9510](https://cve.now/CVE-2018-9510.md): In smp\_proc\_enc\_info of smp\_act.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Google Android)
- [CVE-2018-9511](https://cve.now/CVE-2018-9511.md): In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. (no CVSS, Google Android)
- [CVE-2018-9513](https://cve.now/CVE-2018-9513.md): In copy\_process of fork.c, there is possible memory corruption due to a double free. (no CVSS, Google Android)
- [CVE-2018-9514](https://cve.now/CVE-2018-9514.md): In sdcardfs\_open of file.c, there is a possible Use After Free due to an unusual root cause. (no CVSS, Google Android)
- [CVE-2018-9515](https://cve.now/CVE-2018-9515.md): In sdcardfs\_create and sdcardfs\_mkdir of inode.c, there is a possible memory corruption due to improper locking. (no CVSS, Google Android)
- [CVE-2018-15563](https://cve.now/CVE-2018-15563.md): \_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles\[en\] parameter. (no CVSS, intelliants/subrion)
- [CVE-2018-15752](https://cve.now/CVE-2018-15752.md): An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. (no CVSS)
- [CVE-2018-15753](https://cve.now/CVE-2018-15753.md): An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. (no CVSS)
- [CVE-2018-16984](https://cve.now/CVE-2018-16984.md): An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. (no CVSS, django)
- [CVE-2018-17587](https://cve.now/CVE-2018-17587.md): AirTies Air 5750 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. (no CVSS)
- [CVE-2018-17588](https://cve.now/CVE-2018-17588.md): AirTies Air 5021 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. (no CVSS)
- [CVE-2018-17589](https://cve.now/CVE-2018-17589.md): AirTies Air 5650 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. (no CVSS)
- [CVE-2018-17590](https://cve.now/CVE-2018-17590.md): AirTies Air 5442 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. (no CVSS)
- [CVE-2018-17591](https://cve.now/CVE-2018-17591.md): AirTies Air 5343v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. (no CVSS)
- [CVE-2018-17593](https://cve.now/CVE-2018-17593.md): AirTies Air 5453 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. (no CVSS)
- [CVE-2018-17594](https://cve.now/CVE-2018-17594.md): AirTies Air 5443v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. (no CVSS)
- [CVE-2018-17595](https://cve.now/CVE-2018-17595.md): In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI. (no CVSS)
- [CVE-2018-17596](https://cve.now/CVE-2018-17596.md): In Zoho ManageEngine AssetExplorer, a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName (no CVSS)
- [CVE-2018-17786](https://cve.now/CVE-2018-17786.md): On D-Link DIR-823G devices, ExportSettings.sh, upload\_settings.cgi, GetDownLoadSyslog.sh, and upload\_firmware.cgi do not require authenticat (no CVSS)
- [CVE-2018-17787](https://cve.now/CVE-2018-17787.md): On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data, because thi (no CVSS)
- [CVE-2018-17884](https://cve.now/CVE-2018-17884.md): XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH\_INFO to wp-ad (no CVSS)
- [CVE-2018-17886](https://cve.now/CVE-2018-17886.md): An issue was discovered in JEESNS 1.3. (no CVSS)
- [CVE-2018-6261](https://cve.now/CVE-2018-6261.md): NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled which sets incorrect permissions on a file, whic (no CVSS, Nvidia GeForce Experience)
- [CVE-2018-6262](https://cve.now/CVE-2018-6262.md): NVIDIA GeForce Experience prior to 3.15 contains a vulnerability when GameStream is enabled where limited sensitive user information may be (no CVSS, Nvidia GeForce Experience)
- [CVE-2017-1649](https://cve.now/CVE-2017-1649.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-12473](https://cve.now/CVE-2018-12473.md): path traversal in obs-service-tar\_scm (CVSS 3.1, openSUSE Open Build Service)
- [CVE-2018-1395](https://cve.now/CVE-2018-1395.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1403](https://cve.now/CVE-2018-1403.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1404](https://cve.now/CVE-2018-1404.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1405](https://cve.now/CVE-2018-1405.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1439](https://cve.now/CVE-2018-1439.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1440](https://cve.now/CVE-2018-1440.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1498](https://cve.now/CVE-2018-1498.md): IBM Security Guardium EcoSystem 10.5 stores user credentials in plain in clear text which can be read by a local user. (CVSS 6.2, IBM Security Guardium)
- [CVE-2018-1509](https://cve.now/CVE-2018-1509.md): IBM Security Guardium EcoSystem 10.5 does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spo (CVSS 3.7, IBM Security Guardium)
- [CVE-2018-1522](https://cve.now/CVE-2018-1522.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1557](https://cve.now/CVE-2018-1557.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1558](https://cve.now/CVE-2018-1558.md): IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Collaborative Lifecycle Management)
- [CVE-2018-1593](https://cve.now/CVE-2018-1593.md): IBM Multi-Cloud Data Encryption (MDE) 2.1 could allow an unauthorized user to manipulate data due to missing file checksums. (CVSS 3.7, IBM Multi-Cloud Data Encryption)
- [CVE-2018-1601](https://cve.now/CVE-2018-1601.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1605](https://cve.now/CVE-2018-1605.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1691](https://cve.now/CVE-2018-1691.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-1692](https://cve.now/CVE-2018-1692.md): IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager)
- [CVE-2018-9069](https://cve.now/CVE-2018-9069.md): BIOS Write Protection Race Condition (no CVSS, Lenovo Group IdeaPad)
- [CVE-2018-11072](https://cve.now/CVE-2018-11072.md): Dell Digital Delivery versions prior to 3.5.1 contain a DLL Injection Vulnerability. (no CVSS, Dell EMC Dell Digital Delivery)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2018-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.